Detecting Coercive Lures with OCR

InQuest Deep File Inspection (DFI) utilizes machine vision and optical character recognition (OCR) to identify the social engineering component of a variety of malware lures. This is one of the myriads of techniques that we employ to detect novel malware that may leverage previous unseen and undetectable tactics. Acknowledging that phishing is still the predominant access vector for threat actors to carry out their attacks, it is irresponsible to think that it is possible to "Squish the Phish" or get that "click rate" down to zero. In respect to the colloquial security proverb, "Prevention is ideal, but detection is a must", InQuest has been following a variety of different techniques used in malicious documents. On a consistent basis, threat actors are trying to convince the unbeknownst user into "enabling macros" or "enabling content" in order to progress down the attack chain. Typically, these documents contain a macro called "Auto_Open" or "Document_Open", but it could really be any one of a dozen or so canonical names that cause Microsoft Office to automatically execute the macro once the document is opened.

Fig 1. Coercion Lure. 4bda1925f9a18e879eec373263b37ae20581403777bbdf899ca8ba1ae3cefbc9

Over the last two years, we have published technical blogs covering in-depth analysis on some techniques used within these maldocs. Generally, they had low AV detection rates and were vehemently obfuscated to cause frustration to analysts and security products.

[Extracting "Sneaky" Excel XLM Macros](https://inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files)

[Getting Sneakier: Hidden Sheets, Data Connections, and XLM Macros](https://inquest.net/blog/2020/03/18/Getting-Sneakier-Hidden-Sheets-Data-Connections-and-XLM-Macros)

[ZLoader 4.0 Macrosheets Evolution](https://inquest.net/blog/2020/05/06/ZLoader-4.0-Macrosheets-Evolution)

One successful InQuest signature, "Document Containing Macro Execution Coercion", is described as Microsoft Office document malware carriers that attempt to coerce the user into activating malicious content through on-screen instruction. In some environments, macros are disabled within Microsoft Office, and therefore malicious macros will not be executed by default. Threat actors use different types of lure messages in an attempt to convince users to enable macros so malicious code can be executed. The severity of this event will increase in the presence of other alerts, for example, those pertaining to automatic macro execution, obfuscation, and other suspicious attributes.

Value of OCR

There is appreciable value returned when combining OCR with the DFI process. After the OCR strips the text from the images, de-facto or user-defined threat detection signatures can alert on the text from within the image. For example, deduced text strings in the form of "enable content " or "office version isn't compatible" are frequently used in these documents. Of note, another use case in this scenario could be data-loss detection identifying PII, PHI, PCI, or other sensitive information InQuest Labs consistently sources the strings found in these lures to keep our signatures up to date. Our user base and in-house security engineers have been commenting on the consistent success with this detection technique.

Fig 2. OCR Derived Text.

Tracking Graphical Assets Based on XMP IDs

InQuest has been tracking the graphical assets used in the malicious documents using Adobe Extensible Metadata Platform (XMP) identifiers (IDs). As described in [Adobe XMP: Tales of an Overlooked Anchor](https://inquest.net/blog/2019/09/30/Adobe-XMP-Tales-of-an-Overlooked-Anchor), the hashes / GUIDs are used as a standard for mapping graphical asset relationships, XMP allows for tracking of both parent-child relationships and individual revisions. There are three categories of identifiers: original document, document, and instance. Generally, XMP data is stored in XML format, updated on save/copy, and embedded within the graphical asset. The following list of XMP IDs was harvested from the most common graphical lure templates:


    037efa89-9f85-d141-bdcb-7fc208a9471f
    25720195-077c-684a-b376-ddb0eec9490d
    4da1efc4-3be3-db47-ad6a-94bef19999d7
    5a11ba92-5aa2-dd4c-9428-76c6845a42e9
    7d130047-163d-7c4b-ad85-c450be72e18e
    8044e5c8-00df-004b-a352-8ad4178136bf
    9cb60a7b-deba-d647-b8f5-5940685d2ab5
    baebffad-e645-e048-95f1-302ea6696408
    ce1f5951-83ee-0949-a431-1a7ed96b5005
    cf388654-c5b4-264f-b9bf-723c838a6b4d
    e48fd268-0a9f-cb49-b560-b2b7bd429157
    faf5bdd5-ba3d-11da-ad31-d33d75182f1b

Note that the above happen to be all in GUID format, but hash format is plausible as well.

Gallery of Common Graphical Lure Templates

The following gallery of lures was harvested from a variety of malware samples collected over the past 30 days. Common among these lures is that they all capable of evading common detection stacks.